Movable Type software by Six Apart Ltd. has a code injection vulnerability in its Dynamic Publishing functionality. No specific affected versions or exploit details are provided.
Red Hat OpenShift Container Platform 4.13.73 includes updates that address multiple security vulnerabilities, including arbitrary code execution via cross-site scripting, denial of service via malformed HTTP/2 frames, privilege escalation through incorrect Punycode processing, and man-in-the-middle attacks via untrusted intermediate certificates. The advisory rates the security impact as Important and recommends upgrading to the updated packages and images when available.
Multiple denial of service vulnerabilities have been identified in the Tornado Python web framework, affecting the python-tornado package in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. These vulnerabilities include uncontrolled gzip decompression memory consumption, excessive URL-encoded body fields, memory amplification in multipart parsing, and decompression bomb in CurlAsyncHTTPClient. Red Hat has released security updates to address these issues.
LimeSurvey Community Edition 7.8.0 has an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can craft a .lsa archive with a participant XML that creates an attacker-named attribute column. When exporting responses from the imported survey, the application improperly treats names containing parentheses as SQL expressions, leading to execution of attacker-controlled SQL with database privileges.
CVE-2026-63660 is an integer overflow vulnerability in the mapbox node-fontnik library before version 0.7.7. It occurs in the RenderSDF function where the allocation size for an SDF bitmap is calculated using 32-bit unsigned integers without upper bounds on glyph dimensions. A specially crafted font can cause the multiplication to overflow, resulting in a heap out-of-bounds write and process crash. This flaw has been fixed in version 0.7.7.
Padloc versions 4.0.0 through before 4.3.1 have an authentication bypass vulnerability due to improper restriction of excessive authentication attempts in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email to brute force 6-digit email verification codes without these attempts counting toward the limit, enabling them to obtain verification tokens usable in signup, login, and account recovery processes.
Padloc versions 4.0.0 through 4.3.0 contain a prototype pollution vulnerability that allows SCIM token holders to modify the Object.prototype. This occurs via crafted SCIM PATCH requests to the ScimServer._handleScimUsersPatch() function, enabling attackers to inject properties into the shared server process and disrupt requests for all organizations. The vulnerability is fixed in version 4.3.1.
Mbin versions from 1.2.1 up to but not including 1.11.1 contain a stored cross-site scripting (XSS) vulnerability in the EmbedElement::buildDestructed() function. This flaw allows authenticated users to inject HTML code in the alt text of images nested inside links within various content types such as entries, comments, posts, messages, or bios. The injected script can execute in the browsers of users viewing the affected content. The vulnerability is fixed in version 1.11.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the Special:Ask feature when used with the ElasticStore backend. This flaw allows users with edit permissions to inject malicious scripts through unescaped native_result and score_set outputs. An attacker can embed harmful markup in a Text property or subobject name and then trick other users, including administrators, into visiting a specially crafted Special:Ask link, leading to script execution within their session. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions 7.3.1 through 7.4.0 contain an incorrect authorization vulnerability in the EditProtectionUpdater::userMayChangeProtection() function. This flaw allows editors to bypass administrator edit and move protections by adding a specific template directive that removes protection logged under the administrator's name. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a denial of service vulnerability due to inefficient algorithmic complexity in certain classes. This flaw allows users with page-edit rights to create acyclic chains of Concept: pages that cause excessive CPU and memory consumption when queried, leading to service disruption. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw exists in the ValueFormatter::getFormattedSubject() function, which improperly renders property label segments after a literal non-breaking space ( ) as unescaped markup. Users with page-edit rights can exploit this by setting a preferred property label containing a malicious img onerror payload. This payload executes when any user, including administrators, views the Special:Browse page or accesses the smwbrowse API.
Semantic MediaWiki versions from 2.4.0 up to but not including 7.4.1 contain a reflected cross-site scripting (XSS) vulnerability in the TimeValueFormatter::getCaptionFromFreeFormat() function. This function outputs free-format date captions in HTML without proper escaping, allowing unauthenticated attackers to craft malicious Special:Ask URLs that include HTML markup. When a logged-in user accesses such a URL, the embedded script executes in their browser session. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 have an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter. This flaw allows users with page-edit rights to create mutually referencing concept pages, which can cause concept page views, Special:Ask queries, or api.php action=ask queries to exhaust PHP memory or stack. The issue is fixed in version 7.4.1.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 have a missing authorization vulnerability. This flaw allows editors without the edit-protection right to lock pages by adding an 'Is edit protected' annotation. Attackers can exploit this by adding [[Is edit protected::true]] to pages or widely transcluded templates, causing the TitleQuickPermissions hook to block other editors and administrators from editing, moving, or deleting those pages indefinitely. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the DataTables integration. This flaw allows users with page-edit rights to inject HTML entity-encoded markup into data-search or data-filter cell attributes, which can execute scripts in the browsers of viewers, including administrators. The vulnerability is fixed in version 7.4.1.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the OptionsBuilder::profiles() function. This flaw allows users with the smw-schemaedit permission to inject malicious markup by saving specially crafted FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels. The injected scripts execute for every visitor to the Special:FacetedSearch page, including administrators. The vulnerability is fixed in version 7.4.1.
Multiple security vulnerabilities have been identified in the python-tornado package used in Red Hat Enterprise Linux 9.2. These include information disclosure via improper handling of credentials during HTTP redirects and several denial of service (DoS) issues caused by uncontrolled gzip decompression, excessive URL-encoded body fields, memory amplification in multipart parsing, and decompression bombs in CurlAsyncHTTPClient. Red Hat has released an important security update addressing these issues in python-tornado version 6.5.10-0.el9_2.1.
CVE-2026-63194 is a high-severity path traversal vulnerability in the bahmni-core OpenMRS module version 0.93. It allows an attacker to write arbitrary files during the admin CSV import process due to insufficient input path validation. This issue has been fixed in version 0.93.1.
CVE-2026-63192 is a SQL Injection vulnerability in the bahmni-core module of Bahmni, specifically affecting version 0.93. An attacker with authenticated access could exploit this flaw to exfiltrate sensitive data from the database. The issue has been addressed and patched in version 0.93.1.